CGRC Continuous Monitoring 2

Question 1

Which NIST publication provides the primary framework for implementing an Information Security Continuous Monitoring (ISCM) program?

Accepted Answer

NIST SP 800-137

Answer

NIST SP 800-137 specifically addresses Information Security Continuous Monitoring for federal information systems and organizations.

Question 2

What is the primary purpose of establishing monitoring frequencies in an ISCM strategy?

Accepted Answer

To align oversight intensity with the volatility and criticality of each control

Answer

Monitoring frequencies should be set based on how frequently a control's status can change and the impact if it fails, ensuring resources are focused where risk is highest.

Question 3

An organization discovers its automated vulnerability scanner is missing newly released CVEs because its signature database is 30 days outdated. This is an example of a failure in which ISCM component?

Accepted Answer

Tool and technology management

Answer

Keeping scanning tools and their databases current is a tool and technology management responsibility within the ISCM program.

Question 4

In the context of continuous monitoring, what does 'ongoing authorization' mean?

Accepted Answer

Maintaining authorization decisions current by continuously evaluating risk rather than relying solely on periodic reassessments

Answer

Ongoing authorization shifts from point-in-time reviews to a continuous process where the authorizing official maintains awareness of system risk at all times.

Question 5

Which metric best indicates the effectiveness of a patch management process within an ISCM program?

Accepted Answer

Mean time to remediate critical vulnerabilities after discovery

Answer

Mean time to remediate (MTTR) directly measures how quickly the organization closes exploitable windows after identifying vulnerabilities.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Continuous Monitoring 2